Checklist: Developing a privacy protocol

Download the Template privacy protocol for sharing information within a Kāhui Ako

Step 1: Establish the purpose

What is the purpose for sharing the information


The purpose for sharing information should relate to the purpose of the Kāhui Ako. Be as specific as possible, for example:

  • providing a programme to lift achievement in maths for Year 1 - 8 students
  • supporting students in their transition to a new school or service
  • developing a register of learning support needs across the Kāhui Ako.                                                

Step 2: Name the users

Specify the people who will see it

Restrict access to personal information only to people who need to know.

This can include people working within Kāhui Ako partners such as iwi and community organisations if those organisations sign up to the privacy protocol.

If information is to be discussed at meetings, ensure that only authorised people are in the room.

Step 3: Define process

Plan for securely transmitting, storing and disposing of information

Kāhui Ako need to be particularly aware of security, as communication happens through channels that are not always secure eg emails, shared documents or drives.

Kāhui Ako must keep records of information use and decisions but are not required to hold personal information once a child or young person has left.

Personal information must be held at the school or service according to policies and procedures.

Step 4: Set procedures

Consider how people will access and correct the information.

Think about how you would respond to a privacy breach

People must be able to access and correct any information about them.

There needs to be a clear process to make sure that the data held by the Kāhui Ako is also updated if details are changed at the school, service or original source.

In the event of a privacy breach, decide who will be responsible for responding. The Privacy Commission provides useful guidance on dealing with data breaches.

Step 5: Assign responsibility

Consider appointing a privacy officer

The Kāhui Ako could appoint a privacy officer to ensure that the Kāhui Ako complies with the Privacy Act for the personal information it shares.

The privacy officer could peer review the privacy protocol and would investigate in the case of a privacy breach.

Last reviewed: Has this been useful? Give us your feedback